« first day (545 days earlier)      last day (4420 days later) » 

4 hours later…
8:26 AM
Morning - I like the fact that when I'm not here, the place is more Roried than when I am :-)
2 hours later…
10:09 AM
@Avid - that's 6 posts from satishb3 now, all of which are just a link to his blog. I'll add a comment to each one, if he doesn't improve I guess we can just delete. The blog posts seem alright, but he isn't adding local content here
10:53 AM
@RoryAlsop I've already deleted some of the blanker repetitive ones.
the blog itself is not as questionable as I'd expected, but still just a tad dodgy. probably just looking for some free pagerankings...
@AviD yeah
also had to destroy two obvious spammers - one with a spam answer, one with a spam question
@AviD if he doesn't update them I'll delete them tomorrow
11:08 AM
echh, bugs are gross.
just had a guy clean out a wasp nest from a room off the building hallway.... yuck.
@AviD nice
@RoryAlsop no, not at all.
just glad the wife found it accidentally, before anyone got hurt.
So far, every wasps nest which has appeared in my sheds/garden/etc has been quickly disposed of by spiders
I like spiders :-)
gonna make her clean up the corpses, though, once the poison dries.
@RoryAlsop yukkkk
i dont like bugs of any sort.
Except maybe ladybugs. Cuz they're fancy.
gonna have to get used to the idea, though... probably will have to deal with it a lot in the new garden. :S
noticed quite a lot of slugs trying to get in...
@AviD heh. My youngest likes bugs so much she made an insect hotel - we have planted a lot of bee and butterfly friendly plants as her class had a 'how to make your garden better for the environment' day
Slugs - I am not a fan of
beer and salt, that's the trick
they keep trying to eat my strawberries
for good advice, remember we have a gardening stack exchange
bah - still only on page two over there :-)
I still like this set of graphs - although in order to follow the wider trend that spike is a PITA:
11:26 AM
@RoryAlsop interesting. but why waste good beer on bugs?
@RoryAlsop oo yeah
@RoryAlsop yeah, thats a nice spike, isnt it
but i think we need to trendify those spikages.
huh. I was shocked by some high-traffic new sites, turns out gaming.se changed its name... to Arqade??
wasnt that the name of one of X-Men's villians...?
@AviD did it?
when did that happen
we still need to build up more traffic for the site, though - we're 5 pages down when sorted by traffic.
@RoryAlsop ayup - check this out: Arqade.
no idea when they did that, I dont go there often enough.
looks like it was last week
i go there most days. but hadn't noticed:-)
sweet design:
Q: Introducing Arqade!

JinWe recently have put a lot of effort in coming up with a unique brand name for this community. As you know, naming is hard! After numerous brain storming sessions, we found a great name(and was able to obtain the domain name). It was suggested in a community chat session, and "Arqade" was chosen....

hahaha... just looked up the bugs tag on gardening, love the wiki: Colloquial expression usually referring to arthropods.
theyre just bugs, dammit!
@RoryAlsop yeah, its a cool logo. thats what caught my eye on the SE homepage.
11:44 AM
Hey there
@Mvy afternoon!
@AviD same here. The all loving heart dissappeared from the super-collider menu :S
@Mvy figured out the reason I wasn't aware - my Droidstack app still has the heart
@Mvy heh. I would really like to get some of that swag, but I find it unlikely that I can make it to the second, or even 3rd, page in time. Considering that I have not gained any rep there yet.
11:50 AM
I'm 3.3K and 2nd page ends at 6.2
Besides swag were already distributed with the old logo
not suer they'll do that again
@Mvy heh - you and @IsziRoryorIsznti are close on page 4. The link above says that they will send out new branded swag, and probably go for more than just pages 1 and 2
anyone else think this might be better off over at ServerFault?
Q: Are these standard OAuth2 flows? (what are their names?)

Marty PittI'm developing a B2B platform, where other developers (our customers) will build shop-front style apps that leverage our platform. We expose a REST based API which our customers either call directly from their app servers, or their own client apps can all, on behalf of their users. Their apps a...

12:24 PM
@RoryAlsop Wait... when did I drop from page 2? We didn't get our first swag packages that long ago.
Oh, you're not talking about sec.se...
I thought they moved away from special domain names awhile ago?
@IsziRoryorIsznti in the general case. apparently gaming is "special" enough to warrant it.
besides they're using it as an alias, not as the main URL.
G'day Rories
12:41 PM
:Rory Rory
So I've been watching the Clone Wars series lately. Now I'm going to start mentally replacing the droid's "Roger Roger" with something else. :)
hahaha - excellent
So I'm trying to formulate a question asking about the prospect of data loss when multiple processes write to the same file. Is 'thread-safe' still a technically appropriate term here?
I know the threading model of linux is a little...wonky, but using that word invokes certain implications in my head.
@ScottPack I think thread safe can be used here - especially if you do provide a little explanation as to the risk from the particular race conditions at work
Yeah. What I really wanted to do was, after describing the situation, simply ask if the process is known to be thread safe. Those two words are a pretty substantial shorthand.
12:54 PM
would work for me
but who is your audience
With the hope that any one of you rories know the answer
Q: Implications of unified2 logging with multiple instances of snort

Scott PackI am beginning to migrate my snort logging from alert_syslog to unified2 using barnyard2 as the processor. In some cases I have multiple instances of snort running on the same system. Since I have historically used syslog, it handled the multiple log input without problem, however with the switch...

ahhh - gotcha. I have seen syslog scale to large enterprise, but have no experience of unified2. Sorry
Same here. Syslog, just based on it's asynchronous design, handles the situation pretty trivially.
We're migrating to a new SIEM solution and learned that it selects the parsing engine based on the collection method. I.e., since both Linux events and snort events were being received via syslog it would either parse them as snort or as Linux.
So they recommend using barnyard2 for snort, which means logging out as unified2 instead of syslog.
@ScottPack interesting. I was chatting with a guy at dinner last night who runs his global event monitoring through sourcefire and logrhythms to triage 80million daily events down to 4 or 5 which need action
LogRythmn was one of our three finalists, but we ended up going with Nitro (now McAfee) instead.
I'm not sure how many daily events we actually generate, though it should be fairly easy to graph that out. I pulled together a few metrics for my talk a few weeks ago. Let's see if that was one.
Is he corporate?
1:11 PM
@ScottPack yes, for large financial provider
Ah, there we go, I'm looking at ~5000 snort alerts per day (based on the 30 day period ending 5/15.
The actual Sourcefire product looks pretty sweet. Lots of cool auto-tuning features.
In other news, this is why I dislike OSX top: 523 top 17.8
Why is top taking 18% of my cpu?
RT @mikko: Now that you can buy any top-level domain, I'll buy ".1" and create a host called "127.0.0" under it. Lets see what breaks.
is your CPU loading otherwise pretty low? In which case 18% might not be that bad
@RoryAlsop Well, mdworker is going batshit crazy, so it's hard to tell. When I have top running, though, it's typically within the top 3 processes.
1:27 PM
@ScottPack Isn't that a little recursive?
@IsziRoryorIsznti So's your face.
1:48 PM
Was looking through my old activity, and I sort of wonder if we should feature this lovely case example of how not to secure your computer on the blog:
Q: Do we really need an antivirus? if yes, what for? And how do they activate and enter in a PC?

TottyI've been reading on various sites how PC get infected by viruses and I got: Email attachments (but of course, only if I get an exe and open or execute something, right?) Don't update windows Downloads (the same as email attachments, right?) Pros: I can't think of any worthwhile. Cons: ...

that is remarkable!
@RoryAlsop ?
Is there a way to list questions, sorted by number of views?
I think that'd be a good way to find candidates for QotW.
@IsziRoryorIsznti It doesn't look like it - number of votes is quite useful though
The two tend to be related, so sorting by votes is probably close enough.
I wonder if there's an existing data query for that
I don't know when the last dump happened, since the mobile phone question isn't in there. At most recent, the dump happened a month ago.
2:04 PM
@ScottPack the date of the dump is on data.stackexchange.com → May 8
I think they only do it every 2 months :(
Well. That's a handy column.
I'm a little disappointed in myself that I never noticed it.
The RSS feed of the feeds lists the most recent one as being form April..
@ScottPack that's the data dump you can download, it's updated even less often
So we're consistent with our inconsistency? Cool.
@RoryAlsop So, what was it that was so remarkable?
@IsziRoryorIsznti when?
2:13 PM
@RoryAlsop I don't. I think it best here, but even if for whatever reason you want to migrate it out, I think SO would be a better place for it.
24 mins ago, by Rory Alsop
that is remarkable!
@IsziRoryorIsznti ah - the question
@RoryAlsop How so?
it just amused me
@RoryAlsop You realize that World Gin Day was last Saturday, right?
2:17 PM
I love how he seems to have made our case for us on one hand, yet on the other hand still hasn't learned a thing: "in my case with 54 viruses apparently I have no problem and no stolen money from none of my accounts. Why I can't just live with them?"
All I know is that i've lost 15 pounds since getting the tapeworms and have suffered no ill effects. What's not to love?
@ScottPack yep - I had gin:-)
.5 tsp bitters, 2oz gin. Yummo.
@RoryAlsop Do we know when Sec.SE swag is gonna hit the store?
2:34 PM
Hm. git is telling me a file has been modified, but the diff is empty.
@ScottPack I believe git checks modification by file hashes, whereas the diff usually would not bother showing you difference in e.g. whitespace.
or perhaps file metadata
File hashes are the same. Hmm.
Oo! Maybe so. I added some attributes and filters.
I suppose it could be picking up the attributes.
I would have expected diff to show that, though
@ScottPack depends what you use for diff, but usually it focuses only on file contents, and visible content at that.
then again, maybe I just have my tools tuned that way, being a codemonkey and all.
@IsziRoryorIsznti I don't. @Jin might though :-)
Maybe so. Except for the attribute/filter thing (because I really wanted keyword expansion!) I haven't done any tuning. I have seen git-diff inform me of permission mode changes.
@Gilles Sure I could, but why would I want to? :)
2:53 PM
@ScottPack could what? Is this related to dd/cat?
@Gilles Yeah, but I'm mostly whining.
@RoryAlsop Think you could check in with him, when you have a chance?
@IsziRoryorIsznti will do
Awesome quote out of context, just overheard in my office: "I wanna go get some big, fat, white breasts."
3:01 PM
(He's talking about a craving to have KFC for lunch.)
I just realized: We don't have any west-coasters in chat, do we?
@IsziRoryorIsznti @jin - customers clamouring for swag :-) Do you know when security branded swag might be available to buy?
@IsziRoryorIsznti Honey, on a normal day it's highly possible I'm the westernmost chatter.
@ScottPack I bet that makes you feel real special now, sweetheart.
At least I'm not the most northern.
I keep forgetting how far out that phallus pokes. It looks like I'm further west than Tampa.
I wonder who is
I'm 56 degrees north
3:05 PM
@RoryAlsop Probably you.
@RoryAlsop Pretty sure you're it. Nearest contender I can think of is @JeffFerland.
which means I get more hours of daylight :-)
(in the summer anyway)
it's still light enough to read at midnight this time of year
@IsziRoryorIsznti Oh heavens no. Portland is only at 43 degrees.
@ScottPack Who else is in the UK, as far as regulars go here?
@RoryAlsop Let me tell you, being there in May was pretty tripy.
I spent 5 days waking up at 4:30am before I realized it's because the goddamn sun was up!
@IsziRoryorIsznti Ninefingers
OtherRory, but he never shows up anymore. Neal is in Colorado, but again, he's been pretty absent.
3:10 PM
Hendrik doesn't hang around chat much. Colorado wouldn't be a contender for northernmost, but definitely western.
Depending on where in his country @AviD is, I might be southern-most.
@ScottPack he's down south though, around 52 degrees north
the tropics :-)
@RoryAlsop Still, closer to you than @JeffFerland in terms of latitude.
who what me now?
@RoryAlsop Pretty amusing that your tropics is still 10 degrees north of our frozen wasteland. :)
@AviD We're trying to figure out your latitude.
3:14 PM
@IsziRoryorIsznti that's... kinda personal, isnt it?
pretty sure I'm the southernmost, at least from the usual's here.
I'm gonna say @AviD is in the neighborhood of 32N
Hendrik, when he's here, is probably the northern most. depending on where he is.
@ScottPack good guess!
@ScottPack I'm further south.
@AviD Well, I can't remember which city you're in, but I know one that's pretty central.
I'm around 28N.
3:16 PM
hang on, I'm checking....
hmm. how does one check his latitude??
@AviD Wiki or Google Earth.
How else?
ah, hang on, i got it. (was looking on google maps.
actually its 31.something... so @Scott was damn close.
I'll be here all week.
3:18 PM
@AviD think Hendrik is about 50 north
So, that makes me the most southern, I guess. Until we get some Aussies in here or something.
but I'm moving to 32.almost exactly zero in just a couple weeks...
@AviD I thought you already moved.
3:36 PM
@ScottPack nah, this is my month of move.
but olordy! so much to do.
@AviD As I recall you're moving across town, yes?
@ScottPack different town. bit more norther.
Ah, ok. That sucks a bit. It's a lot harder to move towns.
@AviD have you heard of the degree confluence project?
there are 3 in Israel, and one is at 32 north
A: What is Geocaching?

Rory AlsopSimply put, a cache is hidden at a particular location, and clues are provided (usually via a website, but any media can work) so that searchers can find it. The usual plan is then to open the cache, take an item from it and replace it with something you have brought, and then note your discover...

Ok, it was way too hard to get to the "What the fuck is this?" question.
3:42 PM
my answer there includes it
Well drat. No confluences unvisited in the 3 state area.
Although, it was fun to read up on the closest one to me. On the property of a gaseous diffusion plant.
@ScottPack there is one less than 3 miles from the house I grew up in
and I didn't get there first :-(
3:59 PM
@RoryAlsop hmm I honestly don't know
speaking of Security swag, it's my fav...
I still don't have that cool lil flashlight thing..
@Jin pshaw, you're just saying that to make us collectively blush.
@Jin oh yeah, its awesome. had to hide it from my son, but my 2year old managed to find it anyway - and take it completely apart :)
guys at work(NYC HQ) loved that security flashlight so much, they had me made a Stack Exchange branded one
alas, I don't have that one either...
since I work remote from home in NC
next time I go to NYC HQ, I'm going to loot the supply closet..
Not if I have anything to say about it!
@Jin Weren't you at HQ just a few weeks ago?
@Jin next time you're up we should check out another dim sum place.
4:02 PM
@ScottPack yes, but I forgot to loot..
@PeterGrace ha
@RoryAlsop ahh
@RoryAlsop wait a second, that doesnt make sense. what happend to 32N??
@AviD There exists no record of it's existence.
oh, I see. Creative mapping. Interesting.
@AviD I'm guessing it is considered unsafe to get?
@Jin note to self - next time I visit NYC - loot SEI supply closet. I knew my lockpicking skills would come in handy :-)
interesting, it's actually only a few klicks past my new place. no idea how to get there, though.
@RoryAlsop eh. actually that map is more of a political statement.
4:07 PM
@RoryAlsop Just remember that step of lockpicking is turning the knob....
@ScottPack heh - he said....
@RoryAlsop excellent. oo! that would be a good prize/swag for here, no? Sec.se branded lockpicks...
@AviD We asked for that
I think there are some states of the Union wherein it is illegal to possess lockpicks without a corresponding license.
@AviD oh yeah!!! that would be a cool anniversary prize - we haven't focused on prizes with that meta post. I'm just about to get a train home - anyone fancy raising a meta question on prizes?
@ScottPack it used to be illegal here too, till they realised real criminals use an unlicenced brick
@RoryAlsop Considering I have a pile of a few dozen ~10 pound bricks in my garage? Yeah, that seems pretty reasonable.
@RoryAlsop You thinking another swag giveaway? Like one item for the top users?
4:25 PM
Have a look at the meta question. Almost one year since graduation so SEI like to do something nice
So I guess we can say that I just haven't been given sufficient latitude in my life to be competitive...
5:36 PM
@Jin I still need to replace the batteries in mine. One of them 'sploded.
5:53 PM
@RoryAlsop Cool project there. Hadn't heard of it.
6:04 PM
@IsziRoryorIsznti yeah, it gets very interesting at the poles too: confluence.org/infoconf.php#poles
@RoryAlsop Saw that.
1 hour later…
7:15 PM
can anyone else have a look at this and see if I'm just being a dick? I don't think so, but best to get a sanity check. Have deleted some of the comments already - generally the more confrontational ones
Q: SIEM-AlienVault; Risk Metrics, Assets, and basics

bubbl35Been trying for a week now to get AlienVault (referred to as AV hereon) running with little success. I've gone through 2 installs so far. First time messing with SIEM, though have very limited experience with log collection (splunk, kiwi). Very small network. <10 workstations (win7); 1 W...

@RoryAlsop is this even on-topic? It seems to be more about making AV work than configuring it to be secure
(whatever AV is)
@RoryAlsop Seems like something for SF, if it's an SE question at all. But, it sounds like it's not quite ready for SE yet either.
7:40 PM
@RoryAlsop I still say I wish we could up-vote moderator actions.
Okay... say what, here?
Q: Messing with textfiles

sfxOnce I found something strange. It was a textfile which has stored stolen credentials but has been linked in the public so some people did nasty stuff. That's quite common but I was confused about something interesting: Somebody linked the file the script write the credentials, but it looked like...

@IsziRoryorIsznti VTC'ed and commented
8:20 PM
@RoryAlsop I don't think you're off-base. That guy appears to be a bit confrontational.
9:07 PM
@RoryAlsop as usual, I'm gonna have to go against the crowd a bit...
totally agree about your actions, and that the dickishness was not yours.
but I think most of the actual question is ontopic here, its just hidden by all the rest of the crap.
if it werent for the aforementioned dickishness, I might have put in the effort to trim it to the essential ontopic questions, but as it is I can't be bothered.
@IsziRoryorIsznti indeed.
9:53 PM
@AviD hmmm - okay. I was definitely feeling it is all about "I did this then that, then it stopped working and I don't know why" and even now, looking at those 4 questions at the end, 1 and 2 are not answerable, really, 3 might be and only 4 is a decent question - but it is subjective
@RoryAlsop yeah, I agree - 80% of his question is basically a rant, or looking for emotional support.
but the bulleted questions - I think 1 and 4 are pretty much shopping list questions. but 2 and 3 are legit questions, just need to be cleaned up a bit....
2 is basically saying: given a certain set of circumstances, is it better to do asset discovery, or better to use agents? these are different approaches to SIEM, both valid, both fit better for different circumstances.
or at least, looking for the factors that would help in the tradeoff.
as for 3 (which is really very seperate), some general info on how SIEM policies work, and what they should be.
though that one might be more specific to that product.
anyway, that's my reading of it... and most of the question didnt really relate to that, anyway.
10:38 PM
@AviD Part of it fit into my grey area overlap of SF and Sec.SE. Though, when in doubt, where was it posted first comes into play.
@ScottPack for sure. though when it comes to security products, "how to configure" is clearly SF, and "what should the configuration accomplish" is clearly sec.se - as is architecture, tradeoffs, etc.
@AviD The tricksome part there is that sometimes the audience that would even be able to answer the HowTo part is here, and not there.
@ScottPack thats true too. but as you say, often the overlap works.
For me, I tend to think about what kind of answer I want, and which group I think is most likely to know the answer.
Speaking of groups, wish me luck. Unless things go badly my players get to storm a farm full of Viking warriors in the middle of a funeral celebration.
@ScottPack h-uh??
10:52 PM
In about 8 minutes my Pathfinder group gets started and it's my turn in the DM rotation.
@ScottPack ahhh, of course.

« first day (545 days earlier)      last day (4420 days later) »